Vision Redbridge Culture and Leisure Privacy Policy Version 2.1
-
Introduction
We, Vision Redbridge Culture and Leisure are ‘controllers’ and ‘processors’ of the information that we collect about you (‘personal data’). This means that we may collect and process personal information about you in order to provide you with a range of local leisure and
Data Processing means the things we can do with personal data, including collection, storage, analysis and destruction of the data. In some circumstances Vision may be the processor of data directly, or this may be contracted to a third party. When this happens, we will be clear about who is processing your data.
We are committed to protecting and respecting your privacy; we will be transparent about how we use the data you give to us and ensure that it is securely held.
You may recognise Vision RCL in several ways, whilst we always trade under the name Vision RCL, we break our services down into different divisions which include:
Vision Culture, Vision Leisure, Vision Libraries, Vision Music, Vision Parks, Vision Theatre
From time to time, you may see a shortened version of our Privacy Notice which relate directly to the services that you are accessing. However, all of our privacy notices will provide a link to the main privacy notice on our website.
| Address: | Registered Head Office: Redbridge Central Library, Clements Road, Ilford, IG1 1EA
|
| Email:
|
data.information@visionrcl.org.uk |
Gareth Morley is our Data Protection Officer (DPO). You may contact our Data Protection team using the address above, or by emailing data.information@visionrcl.org.uk
You have certain rights in relation to your personal data including the right to object to processing of your data in certain circumstances. All of these rights are set out in Section 12 of this privacy notice.
2. Who are we and what do we do?
Vision is a charity providing sport, leisure, health & wellbeing, parks, heritage, libraries, arts and culture related services.
You may be more familiar with our services and brands, which are outlined below. We have put together shortened versions of the privacy policy for each of these services.
- Vision Culture (Redbridge Outdoor Arts, Colours of Redbridge, Redbridge Museum)
- Vision Events
- Vision Leisure
- Vision Libraries (Redbridge Libraries)
- Vision Music (Redbridge Music Service)
- Vision Parks
- Vision Theatre (Redbridge Drama Centre and Kenneth More Theatre)
- Vision Venues
Occasionally, we promote and market these services under the ‘Do More’ brand.
Below is a list of Vision websites which collect data from you:
| Web Address | Service | Purpose |
| visionrcl.org.uk | Corporate | To provide an overview of our services |
| Assistant.visionrcl.org.uk | Vision Libraries | AI Library Assistant |
| bookings.visionrcl.org.uk | Vision Venues, Vision Leisure, Vision Parks | To enable the bookings of Vision Venues, Sports Pitches, Owls Play Centre.
To hold the Swimming Lesson Waiting List. |
| tickets.visionrcl.org.uk | Vision Theatre | To enable the bookings of shows at Vision Theatres. |
| libraries.visionrcl.org.uk | Vision Libraries | Customer management of library account |
| valentinesmansion.com | Vision Venues | To showcase Valentines Mansion and Gardens and take booking queries |
| coloursofredbridge.com | Vision Culture | Main website for Colours of Redbridge, a consortium where Vision RCL acts as lead partner. |
| https://vision.bookings.flow.onl/ | Vision Leisure | Leisure Centre membership and booking platform |
| Vision.courseprogress.co.uk/ | Vision Leisure | Swimming Lesson home portal platform |
| Hainaultforest.org | Vision Parks | This site is managed by the Woodland Trust in partnership with Vision RCL. |
3. Your personal data
‘Personal data’ is any information that relates to a living, identifiable person. This data can include your name, contact details, and other information we gather as part of our relationship with you.
It can also include ‘special categories’ of data, which is information about a person’s race or ethnic origin, religious, political or other beliefs, physical or mental health, trade union membership, genetic or biometric data, sex life or sexual orientation. The collection and use of these types of data is subject to strict controls. Similarly, information about criminal convictions and offences is also limited in the way it can be processed.
We are committed to protecting your personal data, whether it falls into ‘special categories’ or not, and we only process data if we need to for a specific purpose, as explained below.
We collect your personal data mostly through our contact with you, and the data is usually provided by you, but in some instances, we may receive data about you from other people/organisations. We will explain when this might happen in this Notice.
4. Data, why it will be processed and our legal basis for processing
| Personal Data Description | Processing Reason | Legal Condition or Basis for processing |
|
Personal details you provide about yourself or a person you care for. This may include: Name, address, email, telephone number, date of birth, age |
Information you provide into our websites, apps or directly to our team via email, telephone or in person allow us to keep an up-to-date record of you and fulfil our contract/ provide a service to you. For example: Membership and bookings administration, service updates, correspondence connected with the services being provided or dealing with complaints and queries.
We may also use this information to verify that you qualify for a concession or discount |
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract Art 6 (1) b)
Processing is necessary for compliance with a legal obligation to which the controller is subject (for example, contractual obligations, or financial and auditing regulations) Art 6 (1) c)
Processing is necessary for the purposes of our legitimate interests -in providing services including customer service, protecting the business and maintaining and providing a secure environment Art 6 (1) f)
Processing is necessary for the purposes of our legitimate interests – training development and quality purposes Art 6 (1) f)
|
|
Information which allows us to recognise you |
When registering for one of our services, you may be provided with a membership ID, a library card number, a theatre account number.
We may also take a photo of you when you join our leisure membership. This helps us to ensure that your card is not misused if lost or stolen. |
Processing is necessary for the purposes of our legitimate interests – training development and quality purposes Art 6 (1) f)
Processing is necessary for the purposes of our legitimate interests -in providing services including customer service, protecting the business and maintaining and providing a secure environment Art 6 (1) f)
|
|
Banking Information |
We will store your bank account number and sort code data where you have a Direct Debit mandate in place. We comply with BACS regulations for the processing of this data and you have specific rights under the Direct Debit guarantee.
We process bank card information at the time we take payment in order to administer our services. This data is not stored on our systems and is processed on Payment Card Industry Data Security Standard compliant banking systems
For some services, you may opt to save your bank details for future use. We will store a bank issued code that can only be used by our systems, but we won’t store your card details. |
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract Art 6 (1) b)
Processing is necessary for compliance with a legal obligation to which the controller is subject (for example, contractual obligations, or financial and auditing regulations) Art 6 (1) c)
Processing is necessary for the purposes of our legitimate interests -in providing services including customer service, protecting the business and maintaining and providing a secure environment Art 6 (1) f)
Processing is necessary for the purposes of our legitimate interests – training development and quality purposes Art 6 (1) f)
|
|
Details of your transactions |
We collect data for any transactions you carry our through our websites or our services. This allows us to administer the services you have with us. |
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract Art 6 (1) b)
Processing is necessary for compliance with a legal obligation to which the controller is subject (for example, contractual obligations, or financial and auditing regulations) Art 6 (1) c)
Processing is necessary for the purposes of our legitimate interests -in providing services including customer service, protecting the business and maintaining and providing a secure environment Art 6 (1) f)
|
|
Attainment/Progression/Goals – in relation to children and adults attending lessons (e.g. swimming lessons or theatre classes) and gym members with personalised training programmes |
To track progression and achievement of those taking lessons in various courses, to ensure their progression, making lessons relevant productive and value for money for the customer; to ensure appropriate levels of skills in each class |
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract Art 6 (1) b)
|
|
Attainment/Progression/Goals – in relation to children attending school swimming lessons |
To track progression and achievement of those taking lessons in swimming lessons and to provide attainment information to the relevant School |
Consent – the school has given its consent to the processing of the students’ personal data for one or more specific purpose Art 6 (1) a)
|
| Customer Feedback | We will record customer comments and surveys about how we are performing to inform future service improvements. | Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
Art 6 (1) b)
|
|
Next of kin/emergency contacts (in relation to customers, and workers including volunteers)
|
To contact NOK or parent in an emergency or in the case of injury illness or death |
Processing is necessary for the purposes of our legitimate interests – we need to be able to get in touch with someone who may be able to help in the event of you becoming ill or injured, or in any other kind of emergency Art 6 (1) f)
|
|
Personal details, contact information, occupation and job location of individuals who have suffered injury or illness or been involved in an incident at one of our venues (all affected customers or visitors); witness contact details
|
To keep report on and submit required records of incidents accidents and near misses. |
Processing is necessary for compliance with a legal obligation to which Vision RCL is subject (e.g. HSE legal obligations of reporting) Art 6 (1) c)
Processing is necessary for the purposes of our legitimate interests – to investigate facts around incidents and accidents and ensure compliance and improvements. For providing relevant information to our insurers. Art 6 (1) f)
|
|
Car registration, name and company name in relation to visiting contractors and workmen
|
To maintain accurate records of persons present in the building in case of evacuation; to keep accurate logs of maintenance visits. |
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract Art 6 (1) b)
Processing is necessary for compliance with a legal obligation to which Vision RCL is subject (e.g. HSE legal obligations of reporting) Art 6 (1) c)
|
| Sensitive Personal Data Description | Processing Reason | Legal Condition or Basis for processing |
|
Race or ethnicity, religious beliefs, or sexual orientation
|
We are sometimes required to collect information in order to provide aggregated reports to the London Borough of Redbridge or to funders. This information is only used for statistical purposes and is always kept secure. If you prefer not to provide us with this data, we will not hold this data.
|
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; Art 6 (1) e)
Processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject Art 9 (2) g) as clarified in DPA 2018 Schedule 1, Part 2, Para 8 – ‘Equality of opportunity or treatment.’
|
| Medical history and accident/injury details | To keep report on and submit required records of incidents accidents and near misses. | Processing is necessary for compliance with a legal obligation to which Vision RCL is subject (e.g. HSE legal obligations of reporting)
Art 6 (1) c) Processing is necessary for the purposes of our legitimate interests – to investigate facts around incidents and accidents and ensure compliance and improvements. For providing relevant information to our insurers and for the welfare of our customers. Art 6 (1) f)
Explicit consent will be requested Art 9 (2) a): and/or Art 9 (2) c) processing is necessary to protect the vital interests of the data subject
|
| Physical or mental health details
for example, anthropometric data, relevant medical history and assessment notes
|
To safely provide, and allow participation in, health related schemes or services, including but not limited to cardiac rehab, weight management, use of some fitness facilities and Spa Treatments | The data subject has given consent to the processing of his or her personal data for one or more specific purposes
Art 6 (1) a) Explicit consent will be requested Art 9 (2) a) If consent is refused or withdrawn, we will be unable to provide the contracted services Art 7 (4)
|
| Disability/underlying medical conditions | Where special category information is collected and processed, it is so we can, if necessary, make reasonable adjustments and safeguard your rights and the interests | To safeguard the data subject’s social protections afforded by various legislation
Art 9 2 (b)
|
|
Personal appearance and behaviour (all customers and users of facilities) |
Collection and monitoring of CCTV images for the purpose of security, the prevention and detection of crime; protection of assets and property; to assist with parking control (in some instances); to facilitate the investigation of incidents
Monitor staff when carrying out work duties; to facilitate in the management and support of staff
|
Processing is necessary for the purposes of our legitimate interests – Maintaining and providing a secure environment Art 6 (1) f)
Processing is necessary for the purposes of our legitimate interests – protection and management of business risks and the legitimate interests of third parties Art 6 (1) f)
|
|
Image of swimmers in pools fitted with assisted lifeguard technology |
Some of our swimming pools are fitted with assisted lifeguard technology to ensure the safety of swimmers and to aid the prevention of drowning. Image date from these cameras is only held for a short period of time in the instance that there has been an alert. There is then a window of 30 days to where we may save footage of an incident in the event that we need the footage for legal purposes.
|
Processing is necessary for the purposes of our legitimate interests – Maintaining and providing a secure environment Art 6 (1) f)
|
5. Data relating to children
Our services are used and accessed by people of all ages. However, children aged under 13 years must have a parent or guardian’s consent before providing personal information to us. We do not wish to collect any personal information without this consent.
Vision Redbridge Culture & Leisure accepts no liability if this instruction is ignored.
6. Cookies
We use cookies on our sites to enhance your experience and ensure the site is functional in order to provide you with a good experience when browsing. We also use cookies to help you choose events that fit your needs.
Full information about the use of cookies, why we use them and how they are applied can be found on our cookie policy, however can be broken down into the following categories:
|
Essential Cookies
|
For the full functional use of our websites we use essential cookies to 1. record the user’s permission (if given) to allow cookies 2. record whether the user has seen the pop-up inviting them to take our customer survey |
|
Performance Cookies
|
For Web statistic analysis – to track usage patterns and deliver customised content to our users
|
|
Usage Cookies
|
Some cookies are used to report on your interactions with the website, these are not readable by Vision RCL but aid us in continual improvement of our websites and digital products.
|
7. Data Received from Third Parties
| Data | Reason for receiving data | Legal Basis |
| Customer data including physical and mental health information from GPs | We receive this data from GPs in order to provide our Exercise on Referral service. This enables the GP to offer a discounted exercise programme to their patient. | The data subject has given consent to the processing of his or her personal data for one or more specific purposes
Art 6 (1) a) As this is special category data, explicit consent will be requested Art 9 (2) a) If consent is refused or withdrawn, we will be unable to provide the health service Art 7 (4)
|
|
|
8. Who we may share your data with
| Data that we may share | With whom we will or may share it |
| Data relating to customers suppliers and visitors (as relevant) | Professional advisors and consultants; Suppliers and service providers; Debt collection and tracing agencies; Business associates and contractors; Credit reference agencies; Financial organisations; Auditors; Health authorities; Health and social welfare organisations; Survey and research organisations
|
| All customers’ and suppliers personal data | With the London Borough of Redbridge as part of our approved data sharing agreement.
The London Borough of Redbridge provide IT services to Vision Redbridge Culture and Leisure and therefore will also have access to data. ICO number Z546078X Lynton House, 255-259 High Road
With Sprint Integration Limited who provide IT services to Vision Leisure services. Monometer House, Rectory Grove, Leigh-on-Sea, Essex. SS9 2HL. Company Registration Number: 04205511. |
| Vision Leisure Customers | With Open Play who provide our leisure management system. Longfrey Cottage, Dorking Road, Chilworth, Guildford, England, GU4 8RH. Company Registration Number: 07720829
With Nuapay, our BACs approved bureau partner to aid in the collection of member and swimming lesson Direct Debits. 506 The Axium, 36 Windmill Street, Birmingham, West Midlands, B1 1FW. Company Registration: 14052903
With Fitronics, providing Course Pro to Vision Leisure swimming lesson and course customers. Gladstone House, Hithercroft Road, Wallingford, Oxfordshire, OX10 9BT. Company Registration: 04530620
Image data shared with Lynxight in order to enhance water safety and drowning prevention, Ha-Tsmikha St 1, Yokne’am Illit, Israel.
Consent only: if a customer registers for the Vision Leisure app, their information will automatically be shared with Innovatise provide the software to run the Vision RCL app. The Clock House, Station Approach, Marlow, England, SL7 1NT. Company Registration Number: 07506993.
To provide the rewards and discounts, Vision Leisure membership IDs are shared with Endurance Zone in order to authenticate the account. 11 Waterloo Place, Royal Leamington Spa, England, CV32 5LA. Company Registration Number: 10450334.
To provide ‘Wellness Anywhere’ benefits, eligibile member IDs are shared with FF HealthKey LTD. Tamar House, 19 Kennington Lane, London, SE11 4XA |
| Vision Library Customers | Vision is a member of The Libraries Consortium and shares personal information with other local authority library services in order to provide you with seamless access to their services with your Redbridge Card. This information is held securely in our shared database. The members of the London Libraries Consortium vary from time to time; a current list may be obtained from your local Redbridge Library, or on our Join the Library page.
We will share data with our software provider, Sirsidynix, The Wenta Business Centre, Colne Way, Watford, England, WD24 7ND. Company Registration Number: 02498901.
|
| Vision Music Customers
|
We deliver music education services funded by the Department for Education, Arts Council England, Redbridge Schools and Redbridge Council. Pupil data, including names, music activities undertaken and attainment information will be shared with the pupil’s Redbridge school to give an overview of pupil achievement and progress
With our software provider, Speed Admin to enable the administration of the service. SpeedAdmin ApS
With Debit Finance Collection, owned by Xplor Technologies for the collection of Direct Debit payments within the service 1st Floor Central Square South, Orchard Street, Newcastle Upon Tyne, United Kingdom, NE1 3AZ Company Registration Number: 03422873
|
| Vision Theatre Customers
|
With our software provider, Savoy Systems to enable the purchasing of tickets and memberships
25 Broad Street, Nottingham, England, NG1 3AP. Company Registration Number: 05851486
With Member Meister for the management of courses and classes 20-22 Wenlock Road, London, England, N1 7GU. Company Registration Number: 08405687
With Go Cardless for the collection of Direct Debit payments for courses and classes GoCardless Ltd, Sutton Yard, 65 Goswell Road, London, EC1V 7EN, United Kingdom Company Registration Number: 07495895
|
| Vision Culture Customers
|
|
| Vision Venues Customers
|
With our software provider, Tracking This to enable venue bookings and management, registered address 4 Heath Square, Boltro Road, Haywards Heath, RH16 1BL. Company Registration Number: 07335017.
With Stripe for processing of payments 9th Floor, 107 Cheapside, London, EC2V 6DN Company Registration Number: 08480771.
|
| Customers taking part in Exercise on Referral
|
With our software provider, Refer All
Office 5, The Mill Building, Company Registration Number: 06830602.
Where required we may share details regarding outcomes of health intervention with a GP or the medical professional who made the referral. Were a medical risk present we may contact GP to share information. If an onward referral is required, we may with consent make a referral (including relevant medical data) to a health team.
|
| Customers taking part in Redbridge Mega Mix or booking events, activities or tickets via the Book When platform
|
With our software provider, Book When
Belsyre Court, 57 Woodstock Road, Oxford, England, OX2 6HJ Company Registration Number: 08914060. |
| Customers who have opted in to receive marketing emails
|
Processed by Mailchimp
Intuit Mailchimp 405 N Angier Ave. NE. Atlanta, GA 30308 USA |
| Customers who contact us using any surveying or form system
|
Processed by Jotform
Jotform Inc. 4 Embarcadero Center, Suite 780, San Francisco CA 94111.
Emails processed by Mailgun One Alliance Center |
| New customers / customers who we market to / contact us on social media accounts | From time to time, we may work with marketing agencies to run marketing campaigns on behalf of Vision RCL. Customers who contact us as part of these campaigns may also have their personal data shared. This will include:
Big Wave Media – Big Wave Media may run campaigns on social media and our sites for and on behalf of Vision RCL. Any data shared with us during this campaigns will also be shared with Big Wave Media exclusively for the purposes of the campaign and fulfilling our campaign offers.
|
9. Transfer of data outside of the UK, EU or EEA
Vision Redbridge generally does not share or transfer any customer visitor or supplier personal data outside of the UK, EU or EEA. However, some software providers are located, or store customer data in other secure ‘third countries’, including the U.S.
In such instances, UK-US Data Bridge is applied.. Secure third countries are those where a suitable level of data protection on the basis of an adequacy decision is confirmed. In those countries, national laws provide a level of protection for personal data which is comparable to those of EU law. We will be clear about where this is happening.
Vision Redbridge will not share, disclose or transfer your personal data outside the UK, EU, EEA or the US without ensuring the appropriate safeguards are in place and in line with legislation. Again, we will make this clear to you where this takes place.
10. How we store and protect your personal data
These are the basic guidelines we use to look after your personal data:
- We maintain secure systems to protect your personal information
- We respect your wishes about how we contact you, whether by post, telephone, email or text message
- We will update your information or preferences promptly when you ask us to
- We will respond fully to requests from you to see the information that we hold on you.
- We will not hold your personal information for longer than is necessary.
- We follow strict procedures when storing or handling information that you have given us. Some information is encrypted, such as payment transactions and password.
- We train our staff in their responsibilities in data protection and information management.
Vision reserves the right to store and process information securely outside of the UK, EU or European Economic Area (“EEA”), but will inform you when this takes place and where appropriate safeguard measures exist.
11. Data Retention
We review our retention periods of the information we hold about you on a regular basis. We will hold your personal information on our systems for as long as it is necessary for the relevant activity or service that we provide to you, or as required by law. We are legally required to hold some types of information to fulfil our statutory obligations, either directly or on behalf of the clients we work for.
12. Rights of the data subject
| Your right | How you can exercise your right | Link to the ICO |
| The right to be informed | All of these are summarised within this Privacy Notice
|
RIGHT TO BE INFORMED |
| The right of access | You can contact us at data.information@visionrcl.org.uk or by completing our Subject Access Request form at https://visionrcl.org.uk/sar to request access to the data
|
RIGHT OF ACCESS |
| The right to rectification | You can contact us at data.information@visionrcl.org.uk there are some circumstances where we may decline to meet your request. If we decline to meet your request, we will explain why and remind you of your right to complain to the Information Commissioners Office or ultimately seek a judicial remedy. More information on reasons we may decline a request can be found in the link.
|
RIGHT TO RECTIFICATION |
| The right to erasure | You can ask for your data to be erased by sending an email to data.information@visionrcl.org.uk We will deal with requests for erasure in accordance with the provisions set out in the link. We will only store and process data that is specifically required for genuine and proper business reasons and for the protection of our business from financial risk and only for the appropriate length of time.
|
RIGHT TO ERASURE |
| The right to restrict processing | You may ask us to block or suppress the processing of your personal data. We will restrict processing of your personal data as requested unless we cannot or choose not to for the permitted reasons which are set out in the link
|
RIGHT TO RESTRICT PROCESSING |
| The right to data portability | How quickly and in what format we will provide your data will be governed by the details on the link.
If we are going to decline your request, we will within one month of the request explain to you why not and will inform you of your right to complain to the Information Commissioner’s Office, and your right to a judicial remedy.
|
RIGHT TO DATA PORTABILITY |
| The right to object | You have the right to object to certain types of processing, or processing for specific reasons. The details are set out in the link
i. processing based on “legitimate interests” or “the performance of a task in the public interest/exercise of official authority (including profiling) on grounds relating to your particular situation; ii. to direct marketing (including profiling);
iii. and to processing for purposes of scientific/historical research and statistics on grounds relating to your particular situation;
|
RIGHT TO OBJECT |
| Rights in relation to automated decision making and profiling | We may profile personal data and sometimes special category data for the purposes of marketing and promotion where individuals have opted into receiving this. You can ask for us to stop sending you marketing information by contacting data.informtion@visionrcl.org.uk | RIGHTS RELATING TO AUTOMATED DECISIONS |
13. Withdrawing Consent
For personal data where we are relying upon your consent as the legal basis for processing (please refer to section 3. Above) you may withdraw your consent at any time by altering your preferences in your online portal for the relevant service and system, or by notifying us at data.information@visionrcl.org.uk
14. Making a complaint
If you feel you have a complaint regarding the processing of your personal data, please contact the Data Protection Officer at data.information@visionrcl.org.uk
15. If you still have concerns regarding your personal data
You may report your concern to the Information Commissioner’s Office – contact details may be found on the ICO website https://ico.org.uk/for-organisations.
